%23%23%20Le%20probl%C3%A8me%20que%20r%C3%A9sout%20transport.data.gouv.fr%0A%0ADans%20un%20pays%20avec%20plus%20de%20330%20r%C3%A9seaux%20de%20transports%20urbains%20et%20des%20dizaines%20de%20milliers%20de%20points%20d%E2%80%99arr%C3%AAts%2C%20il%20est%20parfois%20difficile%20de%20trouver%20le%20meilleur%20moyen%20de%20se%20rendre%20d%E2%80%99un%20point%20A%20%C3%A0%20un%20point%20B.%20%0A%0ATransport.data.gouv.fr%20a%20pour%20mission%20de%20faciliter%20les%20d%C3%A9placements%20des%20usagers%20en%20permettant%20%C3%A0%20tout%20un%20chacun%20de%20d%C3%A9terminer%20le%20plus%20simplement%20possible%20la%20meilleure%20option%20de%20mobilit%C3%A9%20lors%20d%E2%80%99un%20trajet%20%3A%20bus%2C%20tram%2C%20ferry%2C%20m%C3%A9tro%2C%20v%C3%A9lo%2C%20voiture%E2%80%A6%20ou%20tout%20%C3%A0%20la%20fois%20%21%0A%0ALes%20donn%C3%A9es%20de%20transport%2C%20lorsqu%27elles%20existent%2C%20sont%20expos%C3%A9es%20sur%20diff%C3%A9rents%20portails%20de%20diffusion%20de%20donn%C3%A9es%20ouvertes.%20transport.data.gouv.fr%20regroupe%20sur%20une%20m%C3%AAme%20plateforme%2C%20toutes%20les%20donn%C3%A9es%20pertinentes%20pour%20am%C3%A9liorer%20l%E2%80%99information%20dont%20dispose%20les%20usagers%20%E2%80%93%20par%20exemple%20les%20horaires%20des%20lignes%20de%20bus%20partout%20en%20France%2C%20ou%20encore%20la%20localisation%20des%20stations%20de%20v%C3%A9los%20en%20libre%20service.%20Ces%20donn%C3%A9es%20sont%20mises%20%C3%A0%20disposition%20de%20mani%C3%A8re%20ouverte%20avec%20un%20format%20et%20une%20licence%20harmonis%C3%A9es%20afin%20de%20faciliter%20la%20diffusion%20d%E2%80%99une%20information%20voyageur%20fiable%20sur%20tous%20les%20services%20%28planification%20de%20trajets%2C%20covoiturage%E2%80%A6%29%20utilis%C3%A9s%20par%20le%20grand%20public.%0A%0A%23%23%20Les%20r%C3%A9sultats%0A%0AAvec%20plus%20de%20350%20jeux%20de%20donn%C3%A9es%20r%C3%A9f%C3%A9renc%C3%A9s%2C%20transport.data.gouv.fr%20est%20une%20des%20plateformes%20de%20donn%C3%A9es%20de%20transport%20les%20plus%20pl%C3%A9biscit%C3%A9es%20par%20les%20r%C3%A9utilisateurs%20de%20donn%C3%A9es%20et%20acteurs%20de%20mobilit%C3%A9%20comme%20les%20applications%20grand%20public%20de%20calculateurs%20d%E2%80%99itin%C3%A9raires.%20A%20ce%20jour%2C%20elle%20couvre%20plus%20de%2090%25%20de%20la%20population%20fran%C3%A7aise%20dans%2014%20r%C3%A9gions.%0A%0ALes%20statistiques%20compl%C3%A8tes%20sont%20disponibles%20%C3%A0%20https%3A%2F%2Ftransport.data.gouv.fr%2Fstats.%0A%0A%23%23%20Int%C3%A9gration%20de%20transport.data.gouv.fr%20au%20sein%20du%20minist%C3%A8re%20charg%C3%A9%20des%20Transports%0A%0AApr%C3%A8s%203%20ans%20et%20demi%20d%27incubation%20au%20sein%20de%20la%20DINUM%2C%20%5Btransport.data.gouv.fr%20quitte%20le%20programme%20beta.gouv.fr%20et%20est%20officiellement%20transf%C3%A9r%C3%A9%20le%205%20mars%202021%5D%28https%3A%2F%2Fwww.ecologie.gouv.fr%2Ftransportdatagouvfr-lopen-data-au-service-tous-voyageurs-france%29%20%C3%A0%20la%20DGITM%20au%20sein%20du%20minist%C3%A8re%20charg%C3%A9%20des%20Transports.%0A%0AAvec%20transport.data.gouv.fr%2C%20le%20minist%C3%A8re%20charg%C3%A9%20des%20Transports%20se%20dote%20d%E2%80%99un%20outil%20permettant%20de%20conduire%20des%20politiques%20ambitieuses%20en%20mati%C3%A8re%20de%20donn%C3%A9es%20publiques%20ouvertes%20au%20service%20de%20la%20mobilit%C3%A9%20de%20tous%20les%20voyageurs%20et%20favorise%20ainsi%20le%20d%C3%A9veloppement%20de%20services%20num%C3%A9riques%20innovants%20%C3%A0%20fort%20impact.%20La%20facilitation%20de%20l%E2%80%99information%20voyageur%20pose%20la%20premi%C3%A8re%20brique%20de%20la%20mise%20au%20point%20des%20applications%20de%20type%20%C2%AB%20Mobility%20as%20a%20Service%20%C2%BB%2C%20pr%C3%A9vues%20par%20l%E2%80%99article%2028%20de%20la%20Loi%20d%E2%80%99orientation%20des%20mobilit%C3%A9s%2C%20qui%20entre%20en%20vigueur%20le%201er%20juillet%202021.%0A%0A%0A%0A

national_impact

transport. data.gouv.fr

investigation

construction

acceleration

transfer

success

content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

Cookies set without using the Secure flag or set over HTTP

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header not implemented

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header not implemented

default-src 'none';connect-src *;font-src *;img-src 'self' data: https://api.mapbox.com https://static.data.gouv.fr https://www.data.gouv.fr https://*.dmcdn.net https://transport-data-gouv-fr-logos-prod.cellar-c2.services.clever-cloud.com;script-src 'self' 'unsafe-eval' 'unsafe-inline' https://stats.data.gouv.fr/matomo.js;frame-src https://www.dailymotion.com/;style-src 'self' 'nonce-cENSVeQLZ4nDjg' 'sha256-9uoGUaZm3j6W7+Fh2wfvjI8P7zXcclRw5tVUu3qKZa0=' 'sha256-MmUum7+PiN7Rz79EUMm0OmUFWjCx6NZ97rdjoIbTnAg=';report-uri https://o1140487.ingest.sentry.io/api/6197733/security/?sentry_key=ee95fa9a50c747ec93b1467ed9377251&sentry_environment=prod

Diagnostics

Metrics

http

https

socks

pvuniwien

amqp

unknown

tcpwrapped

DNS DMARC - Detect

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

SPF Record - Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

Wappalyzer Technology Detection

A template to detect HTML Forms in page response.


Form Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

_pk_id.58.964a

_pk_ses.58.964a

_transport_key

default-src 'none';connect-src *;font-src *;img-src 'self' data: https://api.mapbox.com https://static.data.gouv.fr https://www.data.gouv.fr https://*.dmcdn.net https://transport-data-gouv-fr-logos-prod.cellar-c2.services.clever-cloud.com;script-src 'self' 'unsafe-eval' 'unsafe-inline' https://stats.data.gouv.fr/matomo.js;frame-src https://www.dailymotion.com/;style-src 'self' 'nonce-k0Z87ndu1dKacQ' 'sha256-9uoGUaZm3j6W7+Fh2wfvjI8P7zXcclRw5tVUu3qKZa0=' 'sha256-MmUum7+PiN7Rz79EUMm0OmUFWjCx6NZ97rdjoIbTnAg=';report-uri https://o1140487.ingest.sentry.io/api/6197733/security/?sentry_key=ee95fa9a50c747ec93b1467ed9377251&sentry_environment=prod

UptimeRobot is a web-based software that is designed to monitor the sites frequently to check whether any site is down owing to server problem or any bug in coding.

UptimeRobot

Erlang is a general-purpose, concurrent, functional programming language, and a garbage-collected runtime system.

Erlang

Cowboy is a small, fast, modular HTTP server written in Erlang.

Cowboy

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Mailchimp is a marketing automation platform and email marketing service.

MailChimp

Mailjet is an email delivery service for marketing and developer teams.

Mailjet

RSS is a family of web feed formats used to publish frequently updated works—such as blog entries, news headlines, audio, and video—in a standardized format.

Open Graph is a protocol that is used to integrate any web page into the social graph.

severity	service	vulnerability
info	http (port:80)
info	bgp (port:179)
info	https (port:443)
info	socks (port:1080)
info	pvuniwien (port:1081)
info	ppp (port:3000)
info	ssh (port:5002)
info	amqp (port:5800)
info	unknown (port:5962)
info	tcpwrapped (port:9999)

Impact	Description	Documentation
-20		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		OWASP Session Management Cheat Sheet.
-20		Doc header Strict-Transport-Security (HSTS).

https://transport.data.gouv.fr

Nmap

Mozilla HTTP observatoryenviron 1 heure

SSL

Grade capped to A. HSTS is not offered

Expiration : 27/06/2024

Nuclei2 jours

Séverité	Name	Matcher
info	DNS DMARC - Detect	dmarc-detect
info	CAA Record	caa-fingerprint
info	NS Record Detection	nameserver-fingerprint
info	SPF Record - Detection	spf-record-detect
info	DNS TXT Record Detected	txt-fingerprint
info	MX Record Detection	mx-fingerprint
info	Wappalyzer Technology Detection	mailchimp
info	Form Detection	form-detection
info	HTTP Missing Security Headers	cross-origin-embedder-policy
info	HTTP Missing Security Headers	cross-origin-opener-policy
info	HTTP Missing Security Headers	cross-origin-resource-policy
info	HTTP Missing Security Headers	strict-transport-security
info	HTTP Missing Security Headers	x-frame-options
info	HTTP Missing Security Headers	referrer-policy
info	HTTP Missing Security Headers	x-permitted-cross-domain-policies
info	HTTP Missing Security Headers	clear-site-data
info	HTTP Missing Security Headers	content-security-policy
info	HTTP Missing Security Headers	permissions-policy
info	HTTP Missing Security Headers	x-content-type-options
info	Detect SSL Certificate Issuer	ssl-issuer
info	SSL DNS Names	ssl-dns-names
info	TLS Version - Detect	tls-version
info	TLS Version - Detect	tls-version